Medium ELSA-2020-1725 2 CVEs

Moderate: haproxy security, bug fix, and enhancement update (Oracle Linux 8)

Published May 5, 2020 · Updated May 5, 2020

Ecosystem: Oracle Linux

Summary

[1.8.23-3]
- Fix hapack zero byte input causing overwrite (CVE-2020-11100, #1819519)

[1.8.23-2]
- Consider exist status 143 as success (#1778844)

[1.8.23-1]
- Update to 1.8.23 (#1774745)

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	haproxy	0:1.8.23-3.el8

Vulnerabilities 2

Unscored —

CVE-2019-18277 EPSS 10%

A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "ch…

haproxy haproxy Debian Ubuntu

Oct 23, 2019
Unscored —

CVE-2019-19330

The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0x…

haproxy haproxy haproxy Debian Ubuntu Alpine

Nov 27, 2019